API Documentation

name: Vericode Security Audit

on:
  push:
    paths: ['contracts/**']
  pull_request:
    paths: ['contracts/**']

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Vericode Audit
        id: audit
        run: |
          # Read all .sol files into JSON
          FILES_JSON=$(python3 -c "
          import json, glob
          files = {}
          for f in glob.glob('contracts/**/*.sol', recursive=True):
              with open(f) as fh:
                  files[f.split('/')[-1]] = fh.read()
          print(json.dumps({'files': files}))
          ")

          # Start audit
          RESULT=$(curl -s -X POST \
            https://vericodeai.com/audit-api/api/ci/audit \
            -H "X-API-Key: ${{ secrets.VERICODE_API_KEY }}" \
            -H "Content-Type: application/json" \
            -d "$FILES_JSON")

          JOB_ID=$(echo "$RESULT" | jq -r '.job_id')
          echo "job_id=$JOB_ID" >> $GITHUB_OUTPUT

          # Poll until completed (max 15 min)
          for i in $(seq 1 90); do
            STATUS=$(curl -s \
              "https://vericodeai.com/audit-api/api/ci/audit/$JOB_ID" \
              -H "X-API-Key: ${{ secrets.VERICODE_API_KEY }}")
            STATE=$(echo "$STATUS" | jq -r '.status')
            if [ "$STATE" = "completed" ]; then
              echo "$STATUS" | jq '.sarif' > results.sarif
              echo "status=completed" >> $GITHUB_OUTPUT
              break
            elif [ "$STATE" = "failed" ]; then
              echo "Audit failed: $(echo $STATUS | jq -r '.error')"
              exit 1
            fi
            echo "Waiting... ($STATE, attempt $i/90)"
            sleep 10
          done

      - name: Upload SARIF to GitHub
        if: steps.audit.outputs.status == 'completed'
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

# Start an audit
curl -X POST https://vericodeai.com/audit-api/api/ci/audit \
  -H "X-API-Key: ci_vericodeai_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "files": {
      "MyContract.sol": "pragma solidity ^0.8.20;\ncontract MyContract { ... }"
    }
  }'

# Response:
# {"job_id": "a1b2c3d4", "status": "queued", "poll_url": "/api/ci/audit/a1b2c3d4"}

# Poll for results
curl https://vericodeai.com/audit-api/api/ci/audit/a1b2c3d4 \
  -H "X-API-Key: ci_vericodeai_YOUR_KEY"

X-API-Key: ci_vericodeai_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4

{
  "version": "2.1.0",
  "$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/...",
  "runs": [{
    "tool": {
      "driver": {
        "name": "VericodeAI",
        "version": "1.0.0",
        "rules": [
          {
            "id": "VERI-CRITICAL-001",
            "shortDescription": { "text": "Reentrancy in withdraw()" },
            "properties": {
              "security-severity": "9.5",
              "tags": ["security", "smart-contract", "solidity"]
            }
          }
        ]
      }
    },
    "results": [
      {
        "ruleId": "VERI-CRITICAL-001",
        "level": "error",
        "message": { "text": "Reentrancy in withdraw()\n\nThe withdraw function..." },
        "locations": [{
          "physicalLocation": {
            "artifactLocation": { "uri": "MyToken.sol" },
            "region": { "startLine": 45, "endLine": 52 }
          }
        }]
      }
    ]
  }]
}

# After polling and saving SARIF:
- name: Upload SARIF to GitHub Code Scanning
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif
    category: vericode-audit